"service logstash start" does not work

(X Calibur) #1


I have Ubuntu 16.10 and the latest Logstash installed.
Running Logstash manually with /usr/share/logstash/bin/logstash "--path.settings" "/etc/logstash" works just fine but I'm unable to run it as a service.
Any help would be greatly appreciated.


Why doesn’t logstash run as a deamon?
(Mark Walkom) #2

What do the logs say?

(Pablo) #3

check what sudo services logstash status says
It will usually explain why the service didn't start

(X Calibur) #4

logstash.service - logstash
Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset:
Active: active (running) since Thu 2017-04-20 10:49:23 IDT; 1min 24s ago
Main PID: 5036 (java)
Tasks: 17 (limit: 4915)
Memory: 315.5M
CPU: 24.560s
CGroup: /system.slice/logstash.service
└─5036 /usr/bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMS

Apr 20 10:49:23 PRIL1ELK02 systemd[1]: Started logstash.

(X Calibur) #5

Even though it shows as being running...well, it just does not.
it does not load my beats config file unless I run it manually.
And the logs are NOT being written to.
Only showing stuff when the manual command is being run.

(Mark Walkom) #6

That doesn't look like the LS log, from /var/log/logstash/?

(X Calibur) #7

does not show anything when running the "service logstash start" command.

(Pablo) #8

Check where your logstash.conf is https://www.elastic.co/guide/en/logstash/current/running-logstash.html
maybe is not picking it up

(X Calibur) #9

You mean logstash.yml or the beats.conf?

logstash.yml is at


(Pablo) #10

I meant logstash.conf
check your systemd config (if you are using systemd) should be in /etc/systemd/system
and will look like this where you will have the location of the logstash.conf

(X Calibur) #11

I found the following:

root@PRIL1ELK02:/etc/systemd/system# cat logstash.service


Load env vars from /etc/default/ and /etc/sysconfig/ if they exist.

Prefixing the path with '-' makes it try to load, but if the file doesn't

exist, it continues onward.

ExecStart=/usr/share/logstash/bin/logstash "--path.settings" "/etc/logstash"


(Pablo) #12

I am not completely sure about this, but the ExecStart should point to your logstash.conf file also, something like:

ExecStart=/usr/share/logstash/bin/logstash "-f /etc/logstash/logstash.conf" "--path.settings" "/etc/logstash"

(X Calibur) #13

I do not have a "logstash.conf" file anywhere.

(Pablo) #14

Oh well, that explains a lot :smile: make sure to have one if you want Logstash to do something.

(X Calibur) #15

Not really.
I think what you refer to as "logstash.conf" is my "beats.conf".

Anyway just came to say that my problem all long was permissions.
/etc/logstash was taken by root ever since I installed Xpack I believe.

Now the service works as it should.

(system) #16

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.